GCP Landing Zone serves as a starting point for organizations looking to establish a robust cloud infrastructure on Google Cloud Platform. It provides a pre-defined set of configurations, policies, and resources that ensure consistent deployment standards, security controls, and operational efficiency. With GCP Landing Zone, businesses can accelerate their cloud adoption while maintaining governance and compliance requirements.

1. Community
Day 2023
3rd June, 2023
Ahmedabad

2. Bhuvaneswari
Subramani
Chief Cloud Evangelist
@ Intuitive Cloud
Community
Day 2023
3rd June, 2023
Ahmedabad

3. Architecting for Success: Designing Secure
GCP Landing Zone for Enterprises

4. Introduction to Intuitive

6. Agenda
Background
Resource Hierarchy
Identity Provisioning
Networking
Security
Getting Started

7. Background

8. Customer needs an environment that is
Secure &
Complaint
Meets the organization’s security and
auditing requirements
Scalable and
Resilient
Ready to support highly available and
scalable workloads
Adaptable
and Flexible
Configurable to support evolving business
requirements

9. Why ?

10. Goals
Guardrails
Not Blockers
Automated Scalable Self Service
Auditable Flexible

11. With Capabilities…
Billing
Management
Automated
Shared
Infrastructure
Central Network
Connectivity
Resource
Isolation
Immutable
Security Logs
Support Dev
Lifecycle
Identity and
Access
Management
Security,
Governance &
Compliance

12. You Need A “Landing Zone”
• A configurable, secure, scalable, multi-tenant GCP environment based on
GCP best practices.
• A starting point for net new development and experimentation
• A starting point for migrating applications
• An environment that allows for iteration and extension over time
• An environment that provides enough flexibility and scale up and down as
per business needs

13. Pillars of Landing Zone

14. Landing Zone
Identity
Provisioning
Resource
Hierarchy
Networking
Security

15. Resource Hierarchy

16. Resource Hierarchy

17. Resource Hierarchy - Organization
• Root node of the Resource Hierarchy
• Highest level in the resource hierarchy within GCP Landing Zone.
• Top-level container that owns and controls resources
• Logical and administrative boundaries for managing and organizing resources

18. Resource Hierarchy - Folders
• Folders are a way to further organize resources
• Grouping projects and folders enable granular access control and resource
management.
• Offers flexible structure to align with organizational needs

19. Resource Hierarchy - Projects
● Building blocks for organizing and managing application resources.
● Have unique resources like compute, storage, databases, and networking
configurations.
● Enable isolation and encapsulation for independent management, billing,
and access control.

20. Resource Hierarchy - Resources
● Can be grouped together based on their purpose or ownership.
● Can be given different levels of access control.
● Can be monitored and billed separately.
● Easily moved between projects.

21. Resource Hierarchy - Organization Structure

22. Identity Provisioning

23. Identity
Provisioning
Google
Groups
AD Connect
Authorization
MFA

24. Identity Provisioning
• Set up Azure AD to automatically
provision users and, optionally,
groups to Cloud Identity or Google
Workspace.
• Configure single sign-on
• Create a Google Identity
• Enable MFA

25. Networking

26. Shared VPC
Networking
Service
Project
Host
Project

27. Shared VPC
Host Project: contains one or more Shared VPC
networks. A Shared VPC Admin must first enable a
project as a host project. After that, a Shared VPC
Admin can attach one or more service projects to
it.
Service Project: A service project is any project
that has been attached to a host project by a
Shared VPC Admin. This attachment allows it to
participate in Shared VPC. It's a common practice
to have multiple service projects operated and
administered by different dep
Note: Be it a prod/non-prod environment each &
every environment will contain a Shared VPC

28. Host Project
• Create a Host Project
• Create a VPC and Subnets
• Enable Shared VPC and Subnet Sharing
• Deploy Resources

29. Perimeter Project
• Deploy a Load Balancer
• Setup External Firewall
• Provision SSL Certificate
• Route Traffic through ALB & Firewall
• Setup Cloud Armor to protect
against DDOS attack

30. Networking

31. Connectivity With On Prem

32. Security

33. Data Security
Network
Security
Perimeter
Security

34. Security - Tools

35. Security - Observability (Auditing)
• GCS Log Bucket / Log Sink
exists at the org level
• It’s immutable
• You can directly run BigQuery.

36. Security - Observability (Logging/Monitoring)
• Enable Cloud Logging
• Define Log Entries
• Configure log exports
• Create log filters
• Alerts & Notifications

37. Budgets & Alerts
• Proactive Cost Control
• Granular Monitoring
• Automated Efficiency
• Seamless Integration

38. Getting Started

39. Clone The Repository
Git Repository Local Copy
PBMM compliant landing zone

40. Bootstrapping

41. Non-Prod, Prod, Combined Environments
• Create Project Folder Under Respective
Department
• Setup Various Environments
• Configure VPC and Subnets in Host Project
• Setup Shared VPC
• Attach Service Project

42. Conclusion
• GCP Landing Zone provides enterprises with a standardized and secure
foundation for deploying workloads on Google Cloud Platform.
• Enables consistent governance, security measures, cost optimization,
scalability and agility, and empowers enterprises to leverage the full
potential of Google Cloud Platform.

43. Reference Links
• Decide how to onboard identities to Google Cloud | Landing Zones
• Decide a resource hierarchy for your Google Cloud landing zone | Landing Zones
• Decide the network design for your Google Cloud landing zone | Landing Zones
• Decide the security for your Google Cloud landing zone | Landing Zones

44. Thank You